An improved anonymous authentication scheme for roaming in ubiquitous networks

Abstract

With the evolution of communication technology and the exponential increase of mobile devices, the ubiquitous networking allows people to use our data and computing resources anytime and everywhere. However, numerous security concerns and complicated requirements arise as these ubiquitous networks are deployed throughout people’s lives. To meet the challenge, the user authentication schemes in ubiquitous networks should ensure the essential security properties for the preservation of the privacy with low computational cost. In 2017, Chaudhry et al. proposed a password-based authentication scheme for the roaming in ubiquitous networks to enhance the security. Unfortunately, we found that their scheme remains insecure in its protection of the user privacy. In this paper, we prove that Chaudhry et al.’s scheme is vulnerable to the stolen-mobile device and user impersonation attacks, and its drawbacks comprise the absence of the incorrect login-input detection, the incorrectness of the password change phase, and the absence of the revocation provision. Moreover, we suggest a possible way to fix the security flaw in Chaudhry et al’s scheme by using the biometric-based authentication for which the bio-hash is applied in the implementation of a three-factor authentication. We prove the security of the proposed scheme with the random oracle model and formally verify its security properties using a tool named ProVerif, and analyze it in terms of the computational and communication cost. The analysis result shows that the proposed scheme is suitable for resource-constrained ubiquitous environments.

An enhanced dynamic authentication scheme for mobile satellite communication systems

“…Under this model, an adversary is assumed to have following these abilities: knows the authentication protocol used in the session and can completely control the communication channel between participants, i.e., can eavesdrop, intercept, modify, corrupt and delete the messages transmitted on the insecure public channel. When a mobile device is stolen or picked up, can extract all secret parameters stored in its memory by using power analysis attack 22 can be a legal but malicious user. can enumerate all the elements in the Cartesian product D ID × D PW with polynomial time, where D ID denotes the identity space and D PW denotes the password space 23‐25 To evaluate the forward secrecy, is supposed to obtain the long‐term private key of the participants. …”

A Secure and Lightweight Three-Factor-Based Authentication Scheme for Smart Healthcare Systems

“…We use ProVerif to analyze the security and correctness of our scheme; ProVerif is widely used to verify security protocols [ 7 , 30 , 31 ]. ProVerif is a software tool that formally verifies the security of cryptographic protocols.…”

A Secure Charging System for Electric Vehicles Based on Blockchain

“…We compare communication overheads for the proposed system with related schemes [20,44,45]. We assume timestamp, random number and identity are 32, 64, and 128 bits, respectively [48,49,50]; and elliptic curve cryptography encryption and hash function are 320 and 160 bits, respectively. For the proposed system, we assume group G is generated by P with order q on elliptic curve cryptography y2=x3+ax+b mod p , where p and q are 160 bits prime numbers.…”